Minimax Image Gyh

MiniMax 图像生成模型（image-01），根据文本描述生成高质量图片。使用 MINIMAX_API_KEY 环境变量。

Do not install or run this skill without manual review. Key points to check before using: - The code contains a hardcoded DEFAULT_API_KEY value; confirm whether that key is a placeholder or a working key. If it is valid, using the skill could run requests billed to someone else or leak usage. Prefer removing this fallback and requiring the user to set their own MINIMAX_API_KEY. - The registry metadata omitted MINIMAX_API_KEY even though scripts require it — ask the author to correct metadata so the platform can surface required secrets. - Verify the API host (https://api.minimaxi.com) is the legitimate service you intend to use. If you rely on this skill in production, use an API key you control and run it in an environment with limited network exposure. - Consider running the scripts in an isolated environment (container or VM) and audit network traffic to confirm no unexpected endpoints are contacted. - If you need a safer approval: request the author to remove embedded credentials, document that the embedded key is invalid, and update registry metadata to list MINIMAX_API_KEY as required. If the author confirms the DEFAULT_API_KEY is inert/placeholder, that would increase confidence.

Type: OpenClaw Skill Name: minimax-image-gyh Version: 1.0.0 The skill bundle provides functional image generation via the MiniMax API, but it contains a hardcoded, high-entropy API key (DEFAULT_API_KEY) in both 'minimax-image/scripts/generate_image.py' and 'scripts/generate_image.py'. While the scripts prioritize the user's environment variable (MINIMAX_API_KEY) and do not exhibit clear evidence of data exfiltration or unauthorized execution, the inclusion of hardcoded credentials is a severe security vulnerability and a significant red flag for supply chain risk. All network traffic is directed to the legitimate 'api.minimaxi.com' endpoint.